Delegated Access
Delegated access gives BYFORCE a vendor-native user, collaborator or authorization path instead of sharing a primary account credential.
Also called: vendor invitation, collaborator access
Definition
Delegated access is a vendor-native way to give a separate user, collaborator or application permission to the systems required by the implementation.
Why it matters to the business
It keeps ownership with the client while giving the implementation an auditable route to the systems in scope.
How it works
The client invites a scoped user, approves OAuth or uses another vendor-native method. Where a vendor offers no delegated option, an approved secure one-time exchange is used instead.
Where it appears in real systems
CRM audit roles, platform collaborators and OAuth connections are typical delegated-access patterns.
Common failure modes
- A primary owner password is pasted into an ordinary form.
- The invitation grants unrelated system access.
- Access remains active after it is no longer needed.
Implementation considerations
- Prefer vendor invitations or OAuth.
- Use least privilege.
- Review temporary access at handoff.
When it is appropriate
Use delegated access wherever the vendor supports the required scope.
When it is not appropriate
Do not force delegated roles that cannot perform the agreed work; choose the narrowest workable secure method.
Relationship to BYFORCE
BYFORCE intake separates describing required access from provisioning the sensitive authorization itself.
Source basis
- docs/website/BYFORCE_SELF_SERVICE_INTAKE_SPEC_2026-09-23.json